Employee Monitoring and SimpleHelp Software Abused in | Huntress

What it is

Two intrusions (late January–early February 2026) triaged by Huntress Tactical Response in which a single actor abused Net Monitor for Employees Professional (NetworkLookout) as a covert RAT, paired with a renamed SimpleHelp RMM agent, ending in an attempted Crazy ransomware deployment. The value the summary omits is the concrete host-level and network IOCs for hunting.

How it works

The Net Monitor install supports customizing service and process names, letting the actor blend in. The tool's main binary lsa.exe spawns the bundled pseudo-terminal winpty-agent.exe, which gives full command execution. From that terminal the actor ran net commands (user enumeration, password resets, new account creation), attempted to enable the built-in Administrator, and disabled the Guest account. The same terminal used PowerShell to pull vhost.exe — a renamed SimpleHelp binary — from 160.191.182[.]41; that agent then beaconed to a SimpleHelp server at 192.144.34[.]42 and was used to run further commands including Windows Defender registry tampering.

flowchart TD
    A[Net Monitor lsa.exe] --> B[winpty-agent.exe pseudo-terminal]
    B --> C[net commands: enum, reset, create, enable Admin]
    B --> D[PowerShell downloads vhost.exe]
    D --> E[SimpleHelp agent - redundant persistence]
    E --> F[Defender registry tampering]
    F --> G[Attempted Crazy ransomware]

Preconditions / Affected

Windows hosts where Net Monitor for Employees or SimpleHelp can be installed and run without administrator scrutiny. Neither tool is malware, so the risk is legitimate remote-access software present without a matching admin/rollout record (GPO, Intune).

What to do

Hunt for the specifics the summary lacks:

• Network IOCs: 160.191.182[.]41 (payload host), 192.144.34[.]42 (SimpleHelp C2).
• Process lineage: winpty-agent.exe spawned from lsa.exe; net commands spawned from a remote-monitoring tool; PowerShell downloading vhost.exe.
• Masquerade artifacts: Net Monitor agent disguised as OneDrive — service OneDriveSvc, process OneDriver.exe, running binary renamed to svchost.exe.
• Persistence filename: vhost.exe (renamed SimpleHelp) reused across both cases.
• Treat any Net Monitor / SimpleHelp install without a documented administrative origin as suspect; check for Defender registry modifications and multiple dropped copies of a ransomware binary (indicating repeated failed execution).

The SimpleHelp agent in case #2 also carried keyword triggers for crypto wallets, exchanges, blockchain explorers, payment platforms, and remote-access tools (RDP, AnyDesk, TeamViewer, VNC) — useful as an attribution/scope signal if you find a SimpleHelp config.

Caveats

The single-actor attribution rests on shared infrastructure, the reused vhost.exe filename, and overlapping tradecraft — Huntress states this "strongly suggests" one operator, not confirmed. The fetched text cuts off after case #1's Defender tampering, so later-stage details and any full IOC table are not captured here.